Systematic Fuzzing and Testing of TLS Libraries Juraj Somorovsky 1 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 1
Transport Layer Security • The most important crypto protocol • HTTP, SMTP, IMAP … Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 2 2
TLS History Secure Sockets Layer (SSL), SSLv2 Wagner, Schneier: Analysis of 1995 SSLv3 SSLv3 Bleichenbacher’s attack Trasnsport Layer Security 2000 Padding oracle attack 2005 TLS 1.1 TLS 1.2 2010 BEAST, CRIME, BREACH, Lucky 13 TLS 1.3 2015 3 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 3
Questions • How can we test these attacks? • Can we find such attacks automatically? Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 5 5
Approach [SP2-17] 1. Collect TLS libraries 2. 3. Profit Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 6 6
Approach [SP2-17] 1. Collect TLS libraries 2. 3. Profit Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 7 7
Contributions • Flexible TLS framework • Fuzzing, testing, w riting attacks … • High impact vulnerability in OpenSSL • Additional vulnerabilities in Botan, MatrixSSL … • https://github.com/RUB-NDS/TLS-Attacker Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 8 8
Overview 1. TLS Protocol 2. Attacks 3. Framework Prerequisites 4. TLS-Attacker Design 5. Fuzzing 6. Results 7. Conclusions Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 9 9
TLS RSA Handshake ClientHello ServerHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec (Client-) Finished ChangeCipherSpec (Server-) Finished Application Application Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 10 10
TLS is complex … • Different versions • Crypto primitives: RSA, EC, AES, 3DES, RC4, Chacha, Poly1305, New Hope • Extensions • Protocol flows Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 11 11
TLS is complex … ClientHello ServerHello Certificate ServerKeyExchange Certificate ServerHelloDone ClientKeyExchange CertificateVerify ChangeCipherSpec (Client-) Finished ChangeCipherSpec (Server-) Finished Heartbeat Application Heartbeat Application Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 12 12
Overview 1. TLS Protocol 2. Attacks 3. Framework Prerequisites 4. TLS-Attacker Design 5. Fuzzing 6. Results 7. Conclusions Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 13 13
TLS History Secure Sockets Layer (SSL), SSLv2 Wagner, Schneier: Analysis of 1995 SSLv3 SSLv3 Bleichenbacher’s attack Trasnsport Layer Security 2000 Padding oracle attack 2005 TLS 1.1 TLS 1.2 2010 BEAST, CRIME, BREACH, Lucky 13 TLS 1.3 2015 14 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 14
Early CCS ClientHello ServerHello Certificate ServerHelloDone ClientKeyExchange ChangeCipherSpec (Client-) Finished ChangeCipherSpec (Server-) Finished Server computes the master key based on a zero value Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 15 15
Early CCS • Man-in-the-Middle attacks • Further state machine attacks in 2015: – Beurdouche et al.: FREAK – de Ruiter and Poll Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 16 16
Heartbleed Server [TLS Handshake] Heartbeat 00 07 DeepSec Heartbeat 00 07 DeepSec 17 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 17
Heartbleed Server [TLS Handshake] Heartbeat 10 00 DeepSec Heartbeat 10 00 DeepSec ………. … [rsa key] 18 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 18 ….
Padding oracle attacks • Adaptive chosen-ciphertext attacks Ciphertext C = Enc(M) C 1 valid/invalid C 2 valid/invalid … (repeated several times) M = Dec(C) • AES-CBC: Vaudenay’s attack • RSA-PKCS#1: Bleichenbacher’s attack 20 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 20
Overview 1. TLS Protocol 2. Attacks 3. Framework Prerequisites 4. TLS-Attacker Design 5. Fuzzing 6. Results 7. Conclusions Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 21 21
Recent Attacks on TLS • Not only crypto attacks … • Attacks on TLS state machines – FREAK – Early CCS • Buffer overflows / overreads – Heartbleed – CVE-2016-6307 (High) -> CVE-2016-6309 (Critical) • Tool for flexible protocol executions needed 22 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 22
Framework Prerequisites • Flexible protocol flow ClientHello definition ServerHello Certificate • Message modifications ServerHelloDone • Invalid behavior ClientKeyExchange ClientKeyExchange detection ChangeCipherSpec • Protocol flow (Client-) Finished ChangeCipherSpec reproduction (Server-) Finished Application Application Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 23
Overview 1. TLS Protocol 2. Attacks 3. Framework Prerequisites 4. TLS-Attacker Design 5. Fuzzing 6. Results 7. Conclusions Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 24 24
High-Level Overview Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 25 25
Modifiable variables • Define basic data types (integer, byte, arrays) with modifications • Example: ModifiableInteger i = new ModifiableInteger(); i.setValue( 30 ); i.setModification(new AddModification( 20 )); System.out.println(i.getValue()); // 50 • Further modifications: xor , shuffle, delete, … Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 26 26
Protocol messages • ClientHello ClientHelloMessage cipherSuites: ModifiableByteArray cipherSuiteLength: ModifiableInteger … getCipherSuites() getCipherSuiteLength() • Stored in a message list • Serializable in XML Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 27 27
Defining a protocol flow <protocolMessages> <ClientHello> <supportedCipherSuites> <CipherSuite>TLS_RSA_WITH_AES_128_CBC_SHA</CipherSuite> </supportedCipherSuites> </ClientHello> <ServerHello/> <Certificate/> <ServerHelloDone/> <RSAClientKeyExchange/> <RSAClientKeyExchange/> <ChangeCipherSpec/> <Finished/> <ChangeCipherSpec/> <Finished/> <Application/> </protocolMessages> 29 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 29
Defining a protocol flow <protocolMessages> <ClientHello> <supportedCipherSuites> <CipherSuite>TLS_RSA_WITH_AES_128_CBC_SHA</CipherSuite> </supportedCipherSuites> </ClientHello> <ServerHello/> <Certificate/> <ServerHelloDone/> <RSAClientKeyExchange/> <ChangeCipherSpec/> <Heartbeat> <Finished/> <payloadLength> <ChangeCipherSpec/> <integerAddModification> <Finished/> 20000 <Heartbeat/> </integerAddModification> </protocolMessages> </payloadLength> </Heartbeat> 30 Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 30
Overview 1. TLS Protocol 2. Attacks 3. Framework Prerequisites 4. TLS-Attacker Design 5. Fuzzing 6. Results 7. Conclusions Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 32 32
Vulnerability detection • How do we detect invalid server behavior? 1. Different TLS alerts – Useful by padding oracle attacks 2. Address Sanitizer (ASan) – Detects memory errors at runtime – Available in recent compilers, e.g. GCC • Vulnerability found -> protocol stored in XML Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 33 33
Two-stage concept • Currently only server evaluation 1. Crypto – Padding oracles, Bleichenbacher attack, invalid curve attacks, POODLE … 2. Fuzzing for boundary violations – 3 phases Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 34 34
Fuzzing for boundary violations ClientHelloMessage 1. Variable filtering cipherSuites – Not all variables suitable cipherSuiteLength clientRandom extensions extensionLength …. 2. Fuzzing with filtered variables – Random modifications (add, delete, xor) – Boundary values (-128, -1, 0, 32768, …) 3. Fuzzing with modified protocol flows Juraj j Somorovsky vsky. . Syste temat atic Fuzzing and Testing g of TLS Libraries es 35 35
Recommend
More recommend
